Install¶

Installing Artek-MCP takes four steps: get the module file, install it on the gateway, accept the license agreement, and create an API key for your MCP client. Install it on a test gateway first, and decide what an AI agent should see before you connect it to production.

1. Check the file¶

Download Artek-MCP.modl and compare its SHA-256 with the value published on the download page:

sha256sum Artek-MCP.modl

The module is signed with the Artek, LLC certificate (SHA-1 fingerprint 99e472815b3417abab93e1c744c76699c73375d2). Ignition lists the vendor as "Artek, LLC". The Gateway also verifies the signature and rejects a modified file.

2. Install through the Gateway web interface¶

In the Gateway web interface, open the Modules page and choose Install or Upgrade a Module.
Upload Artek-MCP.modl.
Accept the signing certificate if asked.
Read and accept the End User License Agreement the Gateway shows you. The module does not run until you accept it.

The install wizard records your acceptance itself. Nothing else is needed for a web-interface install.

Headless install through modules.json¶

A scripted install copies the file into the gateway's module folder and registers it in data/modules.json, then restarts the gateway. The entry needs three fields:

{ "filename": "<ignition-install>/user-lib/modules/Artek-MCP.modl",
  "certFingerprint": "99e472815b3417abab93e1c744c76699c73375d2",
  "licenseAgreementHash": 3248084803 }

licenseAgreementHash is mandatory for a headless install

The gateway treats an unaccepted license agreement as a commissioning task. Without licenseAgreementHash, the gateway boots into commissioning: it serves only /welcome and redirects every other route there, including /data/artek-mcp/status and the MCP endpoint. It logs two INFO lines and no ERROR, so it looks like a broken gateway rather than a missing field.

The value is the CRC32 of the license.html entry inside the .modl, written as an unquoted JSON number. For the current agreement it is 3248084803. Recompute it for each release, because any change to the agreement text changes it:

python3 -c "import zipfile;print(zipfile.ZipFile('Artek-MCP.modl').getinfo('license.html').CRC)"

Upgrading headlessly. Write filename, certFingerprint and licenseAgreementHash in the same edit, then re-read the entry before restarting. An older entry without licenseAgreementHash, or one carrying the fingerprint of an earlier Artek certificate, strands the gateway at /welcome on the next restart if you only swap the filename. The gateway asks you once to accept the new certificate.

3. Upgrading from an older build¶

Version numbers restarted at 1.0.0 when the module moved to the Artek, LLC certificate. 1.0.0 and every later version are newer than 1.49 and earlier builds. The module id is unchanged, so install the new build over the old one and your configuration is kept. The Modules page shows the version going down; that is expected.
Very old builds kept their settings in a file at <data>/artek-mcp/config.json. On the first start after the upgrade, that file is migrated unchanged into the settings resource (same API key, same policy), and the old file is archived as <data>/var/com.artek.mcp/config.json.migrated. Fresh installs skip this step.

4. First start: settings and the API key¶

On first start the module creates its settings as an Ignition 8.3 config resource:

<data>/config/resources/core/com.artek.mcp/settings/config.json

It contains a generated 64-character hex API key and the hardened defaults listed on the overview: read-only, deny-all mutation allowlist, 120 requests per minute per key, 1 MiB body cap, origin validation and the destructive-tool name echo on.

To get a key you can give to a client:

Open the module's settings page: Home → Artek MCP → MCP Server (/app/artek-mcp) in the Gateway web interface.
In the API-keys table, add a key with an empty token, or blank an existing key's token.
Save. The gateway generates a new 64-hex token and shows it once in the save confirmation. Copy it now.

Tokens are always shown masked afterwards (**** plus the last 4 characters). Keeping the mask keeps the token unchanged.

Give each client or person its own named key. Keys that share a name or a token are disabled at load until they are made unique. See Configuration for narrowing what each key can reach.

5. Verify the install¶

Status route. Open http://<gateway>:<port>/data/artek-mcp/status. It needs no key and returns a liveness and diagnostics summary with no secrets. A redirect to /welcome means the license agreement has not been accepted (see the headless install note above).
Settings page. Home → Artek MCP → MCP Server shows the version, uptime, counters and the state of each provider.
From your client. After you connect, call the mcp_status tool. It reports the providers, the policy and what your own key can reach.

If a provider you expect is missing, check its enablement on the settings page and the gateway log for the startup line each tool profile writes (see Tools).